1. Information We Collect

We collect several types of information to provide, maintain, and improve our services. The information we gather falls into the following categories.

1.1 Personal Information

When you register for an account or interact with our services, we may collect the following personal information:

• Name, email address, and username you provide during registration
• Profile information such as display name, avatar, and biography
• Authentication credentials (passwords are stored using industry-standard hashing)
• Contact information when you reach out to our support team
• Billing and payment information if you subscribe to a paid plan

1.2 Usage Data

We automatically collect certain information about how you access and use our platform:

• Pages visited, features used, and actions taken within the application
• Device type, browser type, operating system, and screen resolution
• IP address, approximate geographic location, and referring URL
• Session duration, access times, and interaction patterns
• API usage data including endpoints called, request frequency, and response codes

1.3 Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. These include essential session cookies, preference cookies, and optional analytics cookies. For detailed information about the specific cookies we use, please refer to our Cookie Policy.

1.4 Information from Third Parties

We may receive information about you from third-party sources, including:

• Authentication providers when you sign in using a third-party service (such as Single Sign-On)
• Public databases and data aggregators for fraud prevention purposes
• Other users who invite you to collaborate on shared collections

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Service Provision

• Creating and managing your account and collections
• Processing transactions and sending related information
• Providing customer support and responding to inquiries
• Enabling collaboration features and sharing functionality
• Delivering personalized content and recommendations

2.2 Improvements and Development

• Analyzing usage patterns to enhance platform features and user experience
• Conducting research and development on new features
• Testing and debugging software to ensure platform stability
• Monitoring system performance and optimizing infrastructure

2.3 Security and Compliance

• Detecting, preventing, and addressing fraud, abuse, or security incidents
• Enforcing our Terms of Service and other policies
• Complying with applicable legal obligations and regulatory requirements
• Protecting the rights, property, and safety of our users and the public

3. Information Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

3.1 Third-Party Service Providers

We engage trusted third-party companies to perform services on our behalf, including hosting, analytics, email delivery, and payment processing. These providers are contractually obligated to use your data only for the purposes we specify and to maintain appropriate security measures.

3.2 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request. We may also disclose information when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of our users, the public, or Collections Manager.

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information for any other purpose with your explicit consent. Public collections and profile information you choose to make visible are accessible to other users of the platform.

4. Data Storage and Security

4.1 Encryption

All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security). Sensitive data at rest, including passwords and authentication tokens, is encrypted using industry-standard algorithms. We employ AES-256 encryption for stored sensitive data.

4.2 Infrastructure Security

Our infrastructure is hosted on secure, SOC 2-compliant cloud providers. We implement firewalls, intrusion detection systems, and regular security audits. Access to production systems is restricted to authorized personnel using multi-factor authentication.

4.3 Incident Response

We maintain a comprehensive incident response plan to address potential data breaches. In the event of a security incident that may affect your personal data, we will:

• Investigate and contain the incident as quickly as possible
• Notify affected users within 72 hours of confirming a data breach
• Provide details about the nature of the breach, the data involved, and recommended actions
• Report the incident to relevant authorities as required by applicable law
• Conduct a post-incident review to prevent future occurrences

4.4 Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention. Anonymized usage data may be retained indefinitely for analytics and product improvement.

The following retention periods apply to specific data categories:

• Account data: Retained while your account is active; deleted within 30 days of account closure
• Collections and content: Retained while your account is active; deleted upon account closure unless shared with other users
• Server logs: Retained for up to 90 days for security and debugging purposes
• Support communications: Retained for up to 2 years to provide consistent support and resolve disputes
• Payment records: Retained as required by financial regulations (typically 7 years)

5. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

5.1 Access and Portability

You have the right to request a copy of the personal information we hold about you. We provide data export tools in your account settings that allow you to download your collections and profile data in standard formats.

5.2 Correction

You may update or correct your personal information at any time through your account settings. If you need assistance making corrections, please contact our support team.

5.3 Deletion

You may request deletion of your account and associated personal data. You can initiate this process through your account settings or by contacting us directly. Please note that some information may be retained as described in our data retention section.

5.4 Opt-Out

• Marketing Communications: You can unsubscribe from marketing emails using the link provided in each email or through your notification preferences.
• Analytics Cookies: You can opt out of non-essential cookies through your browser settings or our cookie consent mechanism. See our Cookie Policy for details.
• Push Notifications: You can disable push notifications through your browser or device settings at any time.

5.5 Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites you visit that you do not want to be tracked. We respect DNT signals and will not use tracking cookies when such a signal is detected. However, essential cookies required for platform operation will still be set regardless of DNT settings.

5.6 California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell your personal information. To exercise your California privacy rights, please contact us using the information in the Contact Us section below.

5.7 European Privacy Rights

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you may have additional rights under the General Data Protection Regulation (GDPR), including the right to data portability, the right to restrict processing, and the right to lodge a complaint with your local data protection authority. Our legal basis for processing personal data depends on the specific context:

• Contract Performance: Processing necessary to provide you with our services
• Legitimate Interests: Processing for platform improvement, security, and fraud prevention
• Consent: Processing based on your explicit consent, such as analytics cookies
• Legal Obligations: Processing required to comply with applicable laws

6. Children's Privacy

Collections Manager is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently gathered personal data from a child under 13, we will take steps to promptly delete that information from our records.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at privacy@collectionsmanager.com so we can take appropriate action.

Users between the ages of 13 and 18 should review these terms with a parent or guardian to ensure they understand them. We encourage parents and guardians to monitor their children's online activities and to help enforce this policy by instructing their children never to provide personal information on our platform without their permission.

7. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that differ from those in your jurisdiction. When we transfer data internationally, we implement appropriate safeguards to ensure your information remains protected in accordance with this Privacy Policy.

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission, or other lawful transfer mechanisms. We also comply with applicable frameworks and regulations governing cross-border data flows.

We conduct transfer impact assessments to evaluate the level of data protection in the recipient country and implement supplementary measures where necessary. These measures may include additional encryption, pseudonymization, or contractual commitments from data recipients to uphold the same standards of protection we apply.

8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Post the updated policy on this page with a revised effective date
• Notify registered users via email or in-app notification for significant changes
• Provide a summary of key changes where practical

We encourage you to review this policy periodically to stay informed about how we protect your data. Your continued use of our services after the effective date of any changes constitutes acceptance of the updated policy.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us:

• Email: privacy@collectionsmanager.com
• Contact Form: Contact Us Page
• Response Time: We aim to respond to all privacy-related inquiries within 5 business days.

For data subject access requests (DSARs), please include your account email address and a description of the specific data you are requesting. We may need to verify your identity before processing your request to protect the security of your account and personal information.

If you are unsatisfied with our response to a privacy concern, you have the right to lodge a complaint with your local data protection authority.